Views
No views yet
| Field | Value |
|---|---|
| Target | numpy (huntr.com — numpy/numpy) |
| Format | NumPy .npy / .npz array files |
| Vuln | CWE-789 — Unbounded Memory Allocation → MemoryError DoS |
| CVSS | 7.5 High |
| Trigger | numpy.load("bomb.npy") — no flags required |
| Effect | MemoryError: Unable to allocate 8.00 TiB for array with shape (1099511627776,) |
1python3 poc/make_poc.py # creates bomb.npy (128 bytes)
2python3 poc/trigger.py # MemoryError → crashpoc/make_poc.py — builds bomb.npy (128 bytes)poc/trigger.py — triggers crashpoc/bomb.npy — malicious array filereport.md — huntr submission reportevidence/poc-run.html — self-contained HTML evidencenumpy/lib/_format_impl.py — read_array() ~line 1089count = numpy.multiply.reduce(shape, dtype=numpy.int64) — no upper bound on countarray = numpy.ndarray(count, dtype=dtype) — allocates before reading any data.npy file with header declaring shape (2^40,) float64.
numpy.load() computes count=1,099,511,627,776, allocates before reading data → 8 TiB → MemoryError.
Same path applies to .npz files (ZIP of .npy arrays).